Nov 12 2020 04:02 PM - edited Nov 12 2020 04:03 PM
I know how to individually drill into a JSON object with parse_json() and tostring() at the appropriate places to get a specific value. Your own docs for parse_json show that:
It's common to have a JSON string describing a property bag in which one of the "slots" is another JSON string.
For example:
let d='{"a":123, "b":"{\\"c\\":456}"}';
print d
In such cases, it isn't only necessary to invoke parse_json twice, but also to make sure that in the second call, tostring is used. Otherwise, the second call to parse_json will just pass on the input to the output as-is, because its declared type is dynamic.
let d='{"a":123, "b":"{\\"c\\":456}"}';
print d_b_c=parse_json(tostring(parse_json(d).b)).c
Using the same example for 'd' above, what I want to return is a fully deserialized value for 'd', where I can apply json parsing of a string rep at any level I know is needed, while still resulting in a single
'd'-level output result:
{ "a":123, "b": {"c":456 }}
Can you show be an example of doing the above?
Nov 17 2020 09:18 AM
Hi, @dudeed
This totally works for me:
let d='{"a":123, "b":{"c":456}}';
let d_b_c=parse_json(d).b.c;
print d_b_c;
Have you mixed two different problems in the same script?
By the way: There is no KQL in the "insert code samples" window here on the forum!
Kind Regards,
Dennes
Nov 18 2020 12:14 PM
@DennesTorres Yes, that works because that JSON is not composed of separately nested serializations.
I want to get that output with this specific input (the extra double-quotes and escapes are significant and illustrate the core issue I meant). Another words, the value of "b" was serialized first, then sometime later the entire object containing "a" and "b" was serialized to get this payload logged:
'{"a":123, "b":"{\\"c\\":456}"}' // normal one-level deser would think b = the string literal "{\"c\":456}"
I want a one-liner, if you will, that produces exactly this fully deserialized JSON from the above:
{ "a" : 123, "b" : { "c" :456 } }
One can imagine if this trick works for this simple example, it should extrapolate to deeper nestings as well; my guess is there is no simple way to do this atm - you'd need Gson or Newtonsoft-like deserialization parsing support).
Goal: add a single column to my output which is the fully-unwound deserialization of the nested source value like my example. I expect to specify that the value "b" is a serialization point in some way, to not complicate the scenario with the additional chore of auto-detecting the serialization seams.
hth
Nov 22 2020 03:26 AM
Hi, @dudeed ,
You can use string manipulation to change the string and only after all the changes you will de-serialize the json.
I'm talking about remove the slashes ("\\") remove some quotes and so on. The KQL string replace function even supports regex.
Kind Regards,
Dennes